Tradecraft Tuesday | Advanced Phishing for Entry-Level Attackers

Modern phishing kits are lowering the barrier for threat actors to launch credential theft campaigns at scale. Following the emergence of the EvilTokens PhaaS platform, we've seen other PhaaS and phishing kits in 2026, such as Knight Office and Kali365, being used for adversary-in-the-middle (AiTM) and device code phishing campaigns.

Join Andrea Hatcher, Staff Threat Intelligence Analyst, and Rich Mozeleski, Staff Product Manager for Identity Threat Detection and Response, for a technical look at how modern phishing kits work, how attackers operationalize them behind the scenes, and what the resulting activity looks like in endpoint telemetry.